Let me ask you something: if your business lost its files tomorrow, would you know exactly how to get them back?

You may already have automatic backups running. You may even receive a reassuring “backup completed” notification every night. But if you have never restored those files, you do not yet have a proven recovery plan.

It is like locking your office door but never checking whether the key works. The lock may be there. The key may be in your desk. But when an emergency happens, you do not want to discover that the key is damaged.

That is why backup testing matters.

An untested backup can create a false sense of security

A backup job can report success while still failing in ways you will not notice until recovery day.

Maybe the backup skipped a critical folder. Maybe the files are corrupted. Maybe the encryption key is missing. Maybe your cloud backup covers documents but not Microsoft 365 mailboxes, permissions, or application data.

And here is where it gets scary: ransomware may encrypt your production systems and any backup copies that remain connected to the same network.

A backup is not the same as recovery.

Recovery means you can locate a clean restore point, access it, restore the data, open the files, and get your business operating again within an acceptable amount of time. You only know that when you test it.

For additional planning guidance, review our Data Protection 2026 Guide for St. Louis small businesses.

RTO and RPO in plain English

Two terms help you turn a vague backup plan into a practical one: RTO and RPO.

RTO means Recovery Time Objective. It answers this question:

How quickly must you be back in business?

For example, you may decide that your accounting system must be restored within four hours, while an older archive can wait until the next business day.

RPO means Recovery Point Objective. It answers a different question:

How much recent data can you afford to lose?

If your RPO is two hours, your backups must allow you to recover data from within the previous two hours. Otherwise, a system failure at 3 p.m. could force you to recreate everything since your last usable backup.

Think of RTO as the time it takes to reopen your doors. RPO is how much work was lost before you could do it.

Your targets may differ across systems:

• Customer and financial databases may need a short RTO and RPO.
• Shared files may need same-day recovery.
• Archived records may have more flexibility.
• Email may need fast recovery because it supports every department.

The important thing is to write these targets down before you run a restore drill. Otherwise, how will you know whether the result was good enough?

How to run a quarterly restore drill

A quarterly drill does not have to bring your entire company to a halt. You can restore into a test folder, isolated virtual machine, sandbox, or separate Microsoft 365 location.

1. Choose a realistic failure scenario

Do not test only the easiest possible restore.

Rotate through scenarios such as:

• An employee accidentally deletes an important file.
• A server fails without warning.
• A ransomware attack encrypts your live files.
• A Microsoft 365 mailbox needs to be recovered.
• A cloud account or backup appliance becomes unavailable.

Choose a scenario that reflects what could actually happen to your St. Louis, St. Charles County, Chesterfield, Clayton, O'Fallon, or Metro East business.

2. Restore a single file

Start small. Select a file that matters, such as a customer contract, invoice, spreadsheet, or project folder.

Restore it to a separate test location. Then open it in the application your team normally uses.

Check the following:

• Does the file open normally?
• Is it the correct version?
• Are formulas, images, and attachments intact?
• Are the original permissions preserved?
• How long did the restore take?

A file that appears in a folder but will not open is not a successful recovery.

3. Restore a full server or critical application

Next, test a larger recovery. This may involve restoring a file server, virtual machine, database, line-of-business application, or complete system image.

The goal is not only to confirm that the system boots. You also need to verify that normal work can continue.

Can users sign in? Can they access shared files? Can the accounting system process an invoice? Can your applications connect to the restored database?

Record the total time from the start of the restore until a user can complete a normal business task. Compare that result with your RTO.

4. Restore a Microsoft 365 mailbox

Microsoft 365 is powerful, but it should not automatically be treated as a complete backup strategy.

Test a mailbox or folder using your Microsoft 365 backup platform. Restore it to a test mailbox or a clearly labeled recovery folder instead of overwriting live email.

Check:

• Message bodies
• Attachments
• Folder structure
• Dates and senders
• Calendar items
• Contacts
• Searchability
• User access and permissions

A mailbox restore should feel like a real recovery, not a screenshot or export. Your team needs to know whether the recovered messages can actually support daily operations.

Test ransomware protection, not just ordinary recovery

A ransomware-focused restore drill should use an older backup point, not only the newest copy.

Why? Ransomware can remain unnoticed for days or weeks. If you restore from a backup created after the infection began, you may restore the problem along with the data.

Your backup design should follow the basic 3-2-1-1-0 approach:

• Keep at least three copies of important data.
• Use at least two different storage types.
• Keep one copy off-site.
• Keep one copy immutable or offline.
• Maintain zero unverified backups.

An immutable backup cannot be changed or deleted during its protected retention period. An offline or air-gapped backup is disconnected from the network, making it much harder for attackers to reach.

During your quarterly test, try restoring from an older, clean backup. If possible, include a 30-day-old restore point or another point that reflects your retention policy.

For a deeper look at preparation before an attack, read our guide to ransomware protection for St. Louis small businesses.

Do not overlook encrypted cloud backups

Cloud backups can provide excellent flexibility and geographic separation. They can also introduce questions you need to answer before an emergency.

Confirm that your backups are encrypted both in transit and at rest. Then document how the encryption keys are managed.

Here is the practical test: could someone on your team restore critical data if the backup portal, local appliance, or primary administrator account were unavailable?

Your drill should verify:

• Who can access the backup platform?
• Where are recovery credentials stored?
• How are encryption keys retrieved?
• Can you restore without the original workstation?
• Is the cloud backup isolated from everyday administrator accounts?
• Can you recover if the primary network is down?

That is where cloud services for small business need careful planning. Convenience is valuable, but recoverability matters more.

Document every result

A restore drill is only useful if you learn from it.

Keep a recovery log with:

• Date and time of the test
• Person responsible for the test
• Scenario being simulated
• System, file, or mailbox tested
• Backup date and restore point used
• Start and finish times
• RTO and RPO targets
• Pass or fail result
• Problems discovered
• Corrective action
• Person responsible for fixing the issue
• Date of the follow-up test

If a restore fails, do not treat that as wasted effort. You have found the problem while you still have time to fix it.

Retest after major technology changes, including a new server, cloud migration, Microsoft 365 configuration change, backup platform update, or office move.

Practical quarterly backup testing checklist

Use this short checklist to start:

• Confirm RTO and RPO targets for each critical system.
• Restore and open one important file.
• Test a full server, virtual machine, or application recovery.
• Restore a Microsoft 365 mailbox or folder to a test location.
• Test an older backup point for ransomware recovery.
• Confirm an immutable or offline copy is available.
• Verify encryption key and recovery credential access.
• Measure restore time against your RTO.
• Compare the restore point against your RPO.
• Record problems, owners, deadlines, and retest dates.

The same approach works whether your business operates in St. Louis, St. Charles County, Chesterfield, Clayton, O'Fallon, the Metro East, or elsewhere in Missouri.

Know before you need to know

Your backup dashboard can tell you that a job finished. Only a restore test can tell you whether your business is ready.

Platinum Web Services helps small businesses build practical data protection plans, test recovery procedures, and strengthen ransomware protection without adding unnecessary complexity. We provide data recovery services, managed IT services Missouri businesses can rely on, cloud planning, and 24/7 IT support for emergencies.

If you would like a free backup and recovery review, contact Platinum Web Services.

You can also call (636) 204-5335 or email support@platinumwebservices.net.

Our office is located at 7827 Town Square Ave, 104-1184, O'Fallon, MO 63368. Business hours: 24/7.

Your backup plan should not be a promise you hope will work. Test it, document it, improve it, and know it works before you need it.